Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Network Security
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Evernote Limits Hack Damage with Good Security Practices
Evernote Limits Hack Damage with Good Security Practices

By Jennifer LeClaire
March 4, 2013 10:24AM

Bookmark and Share
Security researcher Beth Jones said Evernote did a great job in its security precautions and in dealing with the breach. "First, they did salt and hash the passwords, making them much more difficult to crack," she said. "They owned up to the breach quickly, and even though the passwords were secure, Evernote did a forced reset of all user passwords."
 


Evernote has been hacked, forcing the online note-taking software to reset passwords for its 50 million users, although any password data that was accessed was protected with encryption. What does this mean for enterprise IT security?

"In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost," Evernote's Dave Engberg said in a blog post. "We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed."

Richard S. Westmoreland, a Level III security analyst and team lead at SilverSky, told us the breach was limited and Evernote should be given credit for its fast response and communication to its customers.

"Evernote customers do need to be warned that since their e-mail addresses were mined they should be on the lookout for phishing attempts," he said. "As always, never re-use the same password on multiple sites. But in case anybody has, be sure to change those passwords as well. A breach of an SaaS [software as a service] provider is not limited to that provider but serves as recon for the rest of the cloud.

Evernote Handled It Well

Beth Jones, a senior threat researcher at Sophos, told us that overall, Evernote did a great job in its security precautions and in dealing with the breach.

"First, they did salt and hash the passwords, making them much more difficult to crack," she said. "They were very transparent in releasing information -- they owned up to the breach quickly, and even though the passwords were secure, Evernote did a forced reset of all user passwords, again salting and hashing."

Jones said the company was also quick to point out that no payment details were lost and that hackers were unable to access users' notes. She said Evernote showed what a reasonable response to a security breach should look like.

Room for Improvement

That said, there is room for improvement, Jones said. Evernote could have done better when it sent out its security advisory e-mail.

Evernote explicitly said in the e-mail, "Never click on 'reset password' links in e-mails -- instead go directly to the service," but then had a clickable link to the reset-password page.

"It would have been more advisable to either link to the main page of the site, or even better, no hyperlink at all," Jones said. "It also might have lent a bit more credibility to not have the e-mails passing through a third-party server.

"While it's a legitimate e-mail communications server, it still came off as rather odd, given the messaging in the e-mail itself was about security breaches where they are trying to make the point of 'Never click on reset password links'," Jones said. "As we've pointed out before, this shows where security needs to be at the forefront when trusting your personal data to the cloud."
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Network Security
1.   Banks Hit by Android-Skirting Malware
2.   New Technology Defeats Privacy Efforts
3.   Juniper DDoS for High-IQ Networks
4.   Big DDoS Attacks Hit Record in 2014
5.   Can Google Stop Zero Day Flaws?


advertisement
Android SMS Worm on the Loose
Malware lets bad actors cash in.
Average Rating:
Banks Hit by Android-Skirting Malware
34 institutions, four European countries
Average Rating:
New Technology Defeats Privacy Efforts
Study identifies 3 browser techniques.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.